[User] Stop fabricating an empty main access key when a user has none

## Objective

Let UserInfoContext say that a caller has no main access key, instead of substituting an empty string, and refuse endpoint-ownership delegation to such a target before anything is mutated.

## Background

users.main_access_key is nullable and its foreign key is ON DELETE SET NULL, so deleting a keypair clears it. UserInfoContext.main_access_key is nevertheless typed AccessKey, and the three construction sites paper over the gap with AccessKey(value or "").

That empty string is not inert: purge_user passes it to delegate_endpoint_ownership, which writes it onto the delegated sessions as their owner's access key.

## Acceptance Criteria

- UserInfoContext.main_access_key is AccessKey | None, matching the column.
- No construction site substitutes an empty access key.
- Both purge paths reject a delegation target without a main access key, and do so before migrating shared vfolders or deleting anything.
- Unit and component suites stay green.

## Related

- Found while typing the auth context in BA-7173; the auth-context stack builds on this.

JIRA Issue: BA-7190

Locate UserInfoContext, its three construction sites, and both purge paths, then trace how delegate_endpoint_ownership is reached. Verify the nullable type and removal of empty-string fallbacks, run the unit and component suites, and confirm delegation is rejected before vfolder migration or deletion.

Written by the indexing model from the issue text.